We use sparse matrix estimator to verify that it helps enhancing adversarial robustness. To generate sparse matrix, we consider \(\Sigma \)  such that \(\Sigma _{ii}=1\) , and \(\Sigma _{ij}=r|i-j|^{-\alpha -1}\)  when \(j\ne i\) , where \(r=0.6\)  and \(\alpha =0.2\) . This choice of \((r,\alpha )\)  ensures that all eigenvalues of \(\Sigma \)  are positive. We take \(p=300\) , \(n=200\)  so that the difference between \(\widehat{\Sigma }\)  and \(\widehat{\Sigma }_{sparse}\)  is obvious. The attack level \(\delta \)  is set to be 2 in this comparison. For simplicity, we assume \(\theta _0\)  is known in the comparison of matrix estimators. The sparse covariance estimator \(\widehat{\Sigma }_{sparse}\)  was obtained based on the method in [1]}.
In Table REF , the adversarial excess risk is reduced from 0.0845 (\(R_0(\theta ^*_{\widehat{\Sigma }},\delta )-R_0(\theta ^*,\delta )\) ) to 0.0486 (\(R_0(\theta ^*_{\widehat{\Sigma }_{sparse}},\delta )-R_0(\theta ^*,\delta )\) ), which shows the effectiveness of \(\widehat{\Sigma }_{sparse}\) .
In addition to sparse matrix, we also consider dense covariance matrix generated in the same way as previous experiments by taking \(r=0.6\) . When the true martix is dense, using sparse estimate is not appropriate, thus the corresponding adversarial risk is much higher.
